What is GHSA-3366-gw57-fcm5?

GHSA-3366-gw57-fcm5 is a security advisory published by GitHub Security Advisories with Medium severity. Ella Core panics on malformed ULNASTransport Message without a Request Type

Which CVE IDs does GHSA-3366-gw57-fcm5 cover?

GHSA-3366-gw57-fcm5 covers the following CVE IDs: CVE-2026-33283. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-3366-gw57-fcm5?

GHSA-3366-gw57-fcm5 has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

Which products are affected by GHSA-3366-gw57-fcm5?

GHSA-3366-gw57-fcm5 affects 1 product, including: go/github.com/ellanetworks/core:\u003c 1.6.0.

GHSA-3366-gw57-fcm5MediumCVSS 6.5

Ella Core panics on malformed ULNASTransport Message without a Request Type

Vendor

GitHub Security Advisories

Published

March 19, 2026

Last Modified

March 25, 2026

🔗 CVE IDs covered (1)

CVE-2026-33283 →

📋 Description

Summary

Ella Core panics when processing malformed UL NAS Transport NAS messages without a Request Type.

Impact

An attacker able to send crafted NAS messages to Ella Core can crash the process, causing service disruption for all connected subscribers. No authentication is required.

Fix

Add a guard when receiving an UL NAS Message without a Request Type given no SM Context.

🎯 Affected products1

go/github.com/ellanetworks/core:< 1.6.0

🔗 References (3)

https://github.com/ellanetworks/core/security/advisories/GHSA-3366-gw57-fcm5
https://nvd.nist.gov/vuln/detail/CVE-2026-33283
https://github.com/advisories/GHSA-3366-gw57-fcm5